cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhfmf.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2011,2012 Merlok
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency MIFARE commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include "cmdhfmf.h"
  12
  13 static int CmdHelp(const char *Cmd);
  14
  15 int CmdHF14AMifare(const char *Cmd)
  16 {
  17         uint32_t uid = 0;
  18         uint32_t nt = 0, nr = 0;
  19         uint64_t par_list = 0, ks_list = 0, r_key = 0;
  20         uint8_t isOK = 0;
  21         uint8_t keyBlock[8] = {0};
  22
  23         UsbCommand c = {CMD_READER_MIFARE, {true, 0, 0}};
  24
  25         // message
  26         printf("-------------------------------------------------------------------------\n");
  27         printf("Executing command. Expected execution time: 25sec on average  :-)\n");
  28         printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");
  29         printf("-------------------------------------------------------------------------\n");
  30
  31
  32 start:
  33     clearCommandBuffer();
  34     SendCommand(&c);
  35
  36         //flush queue
  37         while (ukbhit())        getchar();
  38
  39
  40         // wait cycle
  41         while (true) {
  42         printf(".");
  43                 fflush(stdout);
  44                 if (ukbhit()) {
  45                         getchar();
  46                         printf("\naborted via keyboard!\n");
  47                         break;
  48                 }
  49
  50                 UsbCommand resp;
  51                 if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
  52                         isOK  = resp.arg[0] & 0xff;
  53                         uid = (uint32_t)bytes_to_num(resp.d.asBytes +  0, 4);
  54                         nt =  (uint32_t)bytes_to_num(resp.d.asBytes +  4, 4);
  55                         par_list = bytes_to_num(resp.d.asBytes +  8, 8);
  56                         ks_list = bytes_to_num(resp.d.asBytes +  16, 8);
  57                         nr = bytes_to_num(resp.d.asBytes + 24, 4);
  58                         printf("\n\n");
  59                         if (!isOK) PrintAndLog("Proxmark can't get statistic info. Execution aborted.\n");
  60                         break;
  61                 }
  62         }
  63
  64         printf("\n");
  65
  66         // error
  67         if (isOK != 1) return 1;
  68
  69         // execute original function from util nonce2key
  70         if (nonce2key(uid, nt, nr, par_list, ks_list, &r_key))
  71         {
  72                 isOK = 2;
  73                 PrintAndLog("Key not found (lfsr_common_prefix list is null). Nt=%08x", nt);
  74         } else {
  75                 printf("------------------------------------------------------------------\n");
  76                 PrintAndLog("Key found:%012"llx" \n", r_key);
  77
  78                 num_to_bytes(r_key, 6, keyBlock);
  79                 isOK = mfCheckKeys(0, 0, 1, keyBlock, &r_key);
  80         }
  81         if (!isOK)
  82                 PrintAndLog("Found valid key:%012"llx, r_key);
  83         else
  84         {
  85                 if (isOK != 2) PrintAndLog("Found invalid key. ");
  86                 PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce...");
  87                 c.arg[0] = false;
  88                 goto start;
  89         }
  90
  91         return 0;
  92 }
  93
  94 int CmdHF14AMfWrBl(const char *Cmd)
  95 {
  96         uint8_t blockNo = 0;
  97         uint8_t keyType = 0;
  98         uint8_t key[6] = {0, 0, 0, 0, 0, 0};
  99         uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
 100
 101         char cmdp       = 0x00;
 102
 103         if (strlen(Cmd)<3) {
 104                 PrintAndLog("Usage:  hf mf wrbl    <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>");
 105                 PrintAndLog("        sample: hf mf wrbl 0 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F");
 106                 return 0;
 107         }
 108
 109         blockNo = param_get8(Cmd, 0);
 110         cmdp = param_getchar(Cmd, 1);
 111         if (cmdp == 0x00) {
 112                 PrintAndLog("Key type must be A or B");
 113                 return 1;
 114         }
 115         if (cmdp != 'A' && cmdp != 'a') keyType = 1;
 116         if (param_gethex(Cmd, 2, key, 12)) {
 117                 PrintAndLog("Key must include 12 HEX symbols");
 118                 return 1;
 119         }
 120         if (param_gethex(Cmd, 3, bldata, 32)) {
 121                 PrintAndLog("Block data must include 32 HEX symbols");
 122                 return 1;
 123         }
 124         PrintAndLog("--block no:%02x key type:%02x key:%s", blockNo, keyType, sprint_hex(key, 6));
 125         PrintAndLog("--data: %s", sprint_hex(bldata, 16));
 126
 127   UsbCommand c = {CMD_MIFARE_WRITEBL, {blockNo, keyType, 0}};
 128         memcpy(c.d.asBytes, key, 6);
 129         memcpy(c.d.asBytes + 10, bldata, 16);
 130   SendCommand(&c);
 131
 132         UsbCommand resp;
 133         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 134                 uint8_t isOK  = resp.arg[0] & 0xff;
 135                 PrintAndLog("isOk:%02x", isOK);
 136         } else {
 137                 PrintAndLog("Command execute timeout");
 138         }
 139
 140         return 0;
 141 }
 142
 143 int CmdHF14AMfUWrBl(const char *Cmd)
 144 {
 145         uint8_t blockNo = 0;
 146         uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
 147         UsbCommand resp;
 148
 149         if (strlen(Cmd)<3) {
 150                 PrintAndLog("Usage:  hf mf uwrbl    <block number> <block data (8 hex symbols)>");
 151                 PrintAndLog("        sample: hf mf uwrbl 0 01020304");
 152                 return 0;
 153         }
 154
 155         blockNo = param_get8(Cmd, 0);
 156         if (param_gethex(Cmd, 1, bldata, 8)) {
 157                 PrintAndLog("Block data must include 8 HEX symbols");
 158                 return 1;
 159         }
 160
 161         switch(blockNo)
 162         {
 163         case 0:
 164                 PrintAndLog("Access Denied");
 165                 break;
 166         case 1:
 167                 PrintAndLog("Access Denied");
 168                 break;
 169         case 2:
 170                 PrintAndLog("--specialblock no:%02x", blockNo);
 171                 PrintAndLog("--data: %s", sprint_hex(bldata, 4));
 172                 UsbCommand c = {CMD_MIFAREU_WRITEBL, {blockNo}};
 173                 memcpy(c.d.asBytes, bldata, 4);
 174                 SendCommand(&c);
 175
 176                 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 177                         uint8_t isOK  = resp.arg[0] & 0xff;
 178                         PrintAndLog("isOk:%02x", isOK);
 179                 } else {
 180                         PrintAndLog("Command execute timeout");
 181                 }
 182                 break;
 183         case 3:
 184                 PrintAndLog("--specialblock no:%02x", blockNo);
 185                 PrintAndLog("--data: %s", sprint_hex(bldata, 4));
 186                 UsbCommand d = {CMD_MIFAREU_WRITEBL, {blockNo}};
 187                 memcpy(d.d.asBytes,bldata, 4);
 188                 SendCommand(&d);
 189
 190                 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 191                         uint8_t isOK  = resp.arg[0] & 0xff;
 192                         PrintAndLog("isOk:%02x", isOK);
 193                 } else {
 194                         PrintAndLog("Command execute timeout");
 195                 }
 196                 break;
 197         default:
 198                 PrintAndLog("--block no:%02x", blockNo);
 199                 PrintAndLog("--data: %s", sprint_hex(bldata, 4));
 200                 //UsbCommand e = {CMD_MIFAREU_WRITEBL_COMPAT, {blockNo}};
 201                 //memcpy(e.d.asBytes,bldata, 16);
 202                 UsbCommand e = {CMD_MIFAREU_WRITEBL, {blockNo}};
 203                 memcpy(e.d.asBytes,bldata, 4);
 204                 SendCommand(&e);
 205
 206                 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 207                         uint8_t isOK  = resp.arg[0] & 0xff;
 208                         PrintAndLog("isOk:%02x", isOK);
 209                 } else {
 210                         PrintAndLog("Command execute timeout");
 211                 }
 212                 break;
 213         }
 214         return 0;
 215 }
 216
 217 int CmdHF14AMfRdBl(const char *Cmd)
 218 {
 219         uint8_t blockNo = 0;
 220         uint8_t keyType = 0;
 221         uint8_t key[6] = {0, 0, 0, 0, 0, 0};
 222
 223         char cmdp       = 0x00;
 224
 225
 226         if (strlen(Cmd)<3) {
 227                 PrintAndLog("Usage:  hf mf rdbl    <block number> <key A/B> <key (12 hex symbols)>");
 228                 PrintAndLog("        sample: hf mf rdbl 0 A FFFFFFFFFFFF ");
 229                 return 0;
 230         }
 231
 232         blockNo = param_get8(Cmd, 0);
 233         cmdp = param_getchar(Cmd, 1);
 234         if (cmdp == 0x00) {
 235                 PrintAndLog("Key type must be A or B");
 236                 return 1;
 237         }
 238         if (cmdp != 'A' && cmdp != 'a') keyType = 1;
 239         if (param_gethex(Cmd, 2, key, 12)) {
 240                 PrintAndLog("Key must include 12 HEX symbols");
 241                 return 1;
 242         }
 243         PrintAndLog("--block no:%02x key type:%02x key:%s ", blockNo, keyType, sprint_hex(key, 6));
 244
 245   UsbCommand c = {CMD_MIFARE_READBL, {blockNo, keyType, 0}};
 246         memcpy(c.d.asBytes, key, 6);
 247   SendCommand(&c);
 248
 249         UsbCommand resp;
 250         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 251                 uint8_t                isOK  = resp.arg[0] & 0xff;
 252                 uint8_t              * data  = resp.d.asBytes;
 253
 254                 if (isOK)
 255                         PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 16));
 256                 else
 257                         PrintAndLog("isOk:%02x", isOK);
 258         } else {
 259                 PrintAndLog("Command execute timeout");
 260         }
 261
 262   return 0;
 263 }
 264
 265 int CmdHF14AMfURdBl(const char *Cmd)
 266 {
 267         uint8_t blockNo = 0;
 268
 269         if (strlen(Cmd)<1) {
 270                 PrintAndLog("Usage:  hf mf urdbl    <block number>");
 271                 PrintAndLog("        sample: hf mf urdbl 0");
 272                 return 0;
 273         }
 274
 275         blockNo = param_get8(Cmd, 0);
 276         PrintAndLog("--block no:%02x", blockNo);
 277
 278   UsbCommand c = {CMD_MIFAREU_READBL, {blockNo}};
 279   SendCommand(&c);
 280
 281         UsbCommand resp;
 282         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 283                 uint8_t                isOK  = resp.arg[0] & 0xff;
 284                 uint8_t              * data  = resp.d.asBytes;
 285
 286                 if (isOK)
 287                         PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
 288                 else
 289                         PrintAndLog("isOk:%02x", isOK);
 290         } else {
 291                 PrintAndLog("Command execute timeout");
 292         }
 293
 294   return 0;
 295 }
 296
 297 int CmdHF14AMfURdCard(const char *Cmd)
 298 {
 299         int i;
 300         uint8_t sectorNo = 0;
 301         uint8_t *lockbytes_t=NULL;
 302         uint8_t lockbytes[2]={0,0};
 303         bool bit[16]={0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
 304
 305         uint8_t isOK  = 0;
 306         uint8_t * data  = NULL;
 307
 308         if (sectorNo > 15) {
 309                 PrintAndLog("Sector number must be less than 16");
 310                 return 1;
 311         }
 312         PrintAndLog("Attempting to Read Ultralight... ");
 313
 314         UsbCommand c = {CMD_MIFAREU_READCARD, {sectorNo}};
 315         SendCommand(&c);
 316
 317         UsbCommand resp;
 318         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 319                 isOK  = resp.arg[0] & 0xff;
 320                 data  = resp.d.asBytes;
 321
 322                 PrintAndLog("isOk:%02x", isOK);
 323                 if (isOK)
 324                         for (i = 0; i < 16; i++) {
 325                                 switch(i){
 326                                   case 2:
 327                                         //process lock bytes
 328                                         lockbytes_t=data+(i*4);
 329                                         lockbytes[0]=lockbytes_t[2];
 330                                         lockbytes[1]=lockbytes_t[3];
 331                                         for(int j=0; j<16; j++){
 332                                                 bit[j]=lockbytes[j/8] & ( 1 <<(7-j%8));
 333                                         }
 334                                         //PrintAndLog("LB %02x %02x", lockbytes[0],lockbytes[1]);
 335                                         //PrintAndLog("LB2b %02x %02x %02x %02x %02x %02x %02x %02x",bit[8],bit[9],bit[10],bit[11],bit[12],bit[13],bit[14],bit[15]);
 336                                         PrintAndLog("Block %02x:%s ", i,sprint_hex(data + i * 4, 4));
 337                                         break;
 338                                   case 3:
 339                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[4]);
 340                                         break;
 341                                   case 4:
 342                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[3]);
 343                                         break;
 344                                   case 5:
 345                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[2]);
 346                                         break;
 347                                   case 6:
 348                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[1]);
 349                                         break;
 350                                   case 7:
 351                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[0]);
 352                                         break;
 353                                   case 8:
 354                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[15]);
 355                                         break;
 356                                   case 9:
 357                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[14]);
 358                                         break;
 359                                   case 10:
 360                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[13]);
 361                                         break;
 362                                   case 11:
 363                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[12]);
 364                                         break;
 365                                   case 12:
 366                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[11]);
 367                                         break;
 368                                   case 13:
 369                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[10]);
 370                                         break;
 371                                   case 14:
 372                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[9]);
 373                                         break;
 374                                   case 15:
 375                                         PrintAndLog("Block %02x:%s [%d]", i,sprint_hex(data + i * 4, 4),bit[8]);
 376                                         break;
 377                                   default:
 378                                         PrintAndLog("Block %02x:%s ", i,sprint_hex(data + i * 4, 4));
 379                                         break;
 380                                 }
 381                         }
 382         } else {
 383                 PrintAndLog("Command1 execute timeout");
 384         }
 385   return 0;
 386 }
 387
 388 int CmdHF14AMfRdSc(const char *Cmd)
 389 {
 390         int i;
 391         uint8_t sectorNo = 0;
 392         uint8_t keyType = 0;
 393         uint8_t key[6] = {0, 0, 0, 0, 0, 0};
 394
 395         uint8_t isOK  = 0;
 396         uint8_t * data  = NULL;
 397
 398         char cmdp       = 0x00;
 399
 400         if (strlen(Cmd)<3) {
 401                 PrintAndLog("Usage:  hf mf rdsc    <sector number> <key A/B> <key (12 hex symbols)>");
 402                 PrintAndLog("        sample: hf mf rdsc 0 A FFFFFFFFFFFF ");
 403                 return 0;
 404         }
 405
 406         sectorNo = param_get8(Cmd, 0);
 407         if (sectorNo > 63) {
 408                 PrintAndLog("Sector number must be less than 64");
 409                 return 1;
 410         }
 411         cmdp = param_getchar(Cmd, 1);
 412         if (cmdp == 0x00) {
 413                 PrintAndLog("Key type must be A or B");
 414                 return 1;
 415         }
 416         if (cmdp != 'A' && cmdp != 'a') keyType = 1;
 417         if (param_gethex(Cmd, 2, key, 12)) {
 418                 PrintAndLog("Key must include 12 HEX symbols");
 419                 return 1;
 420         }
 421         PrintAndLog("--sector no:%02x key type:%02x key:%s ", sectorNo, keyType, sprint_hex(key, 6));
 422
 423   UsbCommand c = {CMD_MIFARE_READSC, {sectorNo, keyType, 0}};
 424         memcpy(c.d.asBytes, key, 6);
 425   SendCommand(&c);
 426         PrintAndLog(" ");
 427
 428         UsbCommand resp;
 429         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 430                 isOK  = resp.arg[0] & 0xff;
 431                 data  = resp.d.asBytes;
 432
 433                 PrintAndLog("isOk:%02x", isOK);
 434                 if (isOK)
 435                         for (i = 0; i < 2; i++) {
 436                                 PrintAndLog("data:%s", sprint_hex(data + i * 16, 16));
 437                         }
 438         } else {
 439                 PrintAndLog("Command1 execute timeout");
 440         }
 441
 442   // response2
 443         PrintAndLog(" ");
 444         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 445                 isOK  = resp.arg[0] & 0xff;
 446                 data  = resp.d.asBytes;
 447
 448                 if (isOK)
 449                         for (i = 0; i < 2; i++) {
 450                                 PrintAndLog("data:%s", sprint_hex(data + i * 16, 16));
 451                 }
 452         } else {
 453                 PrintAndLog("Command2 execute timeout");
 454         }
 455
 456   return 0;
 457 }
 458
 459 int CmdHF14AMfDump(const char *Cmd)
 460 {
 461         int i, j;
 462
 463         uint8_t keyA[40][6];
 464         uint8_t keyB[40][6];
 465         uint8_t rights[40][4];
 466
 467         FILE *fin;
 468         FILE *fout;
 469
 470         UsbCommand resp;
 471
 472         if ((fin = fopen("dumpkeys.bin","rb")) == NULL) {
 473                 PrintAndLog("Could not find file dumpkeys.bin");
 474                 return 1;
 475         }
 476
 477         if ((fout = fopen("dumpdata.bin","wb")) == NULL) {
 478                 PrintAndLog("Could not create file name dumpdata.bin");
 479                 return 1;
 480         }
 481
 482         // Read key file
 483
 484         for (i=0 ; i<16 ; i++) {
 485                 if (fread( keyA[i], 1, 6, fin ) == 0) {
 486       PrintAndLog("File reading error.");
 487                         return 2;
 488     }
 489         }
 490         for (i=0 ; i<16 ; i++) {
 491                 if (fread( keyB[i], 1, 6, fin ) == 0) {
 492       PrintAndLog("File reading error.");
 493                         return 2;
 494     }
 495         }
 496
 497         // Read access rights to sectors
 498
 499         PrintAndLog("|-----------------------------------------|");
 500         PrintAndLog("|------ Reading sector access bits...-----|");
 501         PrintAndLog("|-----------------------------------------|");
 502
 503         for (i = 0 ; i < 16 ; i++) {
 504                 UsbCommand c = {CMD_MIFARE_READBL, {4*i + 3, 0, 0}};
 505                 memcpy(c.d.asBytes, keyA[i], 6);
 506                 SendCommand(&c);
 507
 508     if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 509                         uint8_t isOK  = resp.arg[0] & 0xff;
 510                         uint8_t *data  = resp.d.asBytes;
 511                         if (isOK){
 512                                 rights[i][0] = ((data[7] & 0x10)>>4) | ((data[8] & 0x1)<<1) | ((data[8] & 0x10)>>2);
 513                                 rights[i][1] = ((data[7] & 0x20)>>5) | ((data[8] & 0x2)<<0) | ((data[8] & 0x20)>>3);
 514                                 rights[i][2] = ((data[7] & 0x40)>>6) | ((data[8] & 0x4)>>1) | ((data[8] & 0x40)>>4);
 515                                 rights[i][3] = ((data[7] & 0x80)>>7) | ((data[8] & 0x8)>>2) | ((data[8] & 0x80)>>5);
 516                                 }
 517                         else{
 518                                 PrintAndLog("Could not get access rights for block %d", i);
 519                         }
 520                 }
 521                 else {
 522                         PrintAndLog("Command execute timeout");
 523                 }
 524         }
 525
 526         // Read blocks and print to file
 527
 528         PrintAndLog("|-----------------------------------------|");
 529         PrintAndLog("|----- Dumping all blocks to file... -----|");
 530         PrintAndLog("|-----------------------------------------|");
 531
 532
 533         for (i=0 ; i<16 ; i++) {
 534                 for (j=0 ; j<4 ; j++) {
 535       bool received = false;
 536
 537       if (j == 3){
 538                                 UsbCommand c = {CMD_MIFARE_READBL, {i*4 + j, 0, 0}};
 539                                 memcpy(c.d.asBytes, keyA[i], 6);
 540                                 SendCommand(&c);
 541         received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
 542                         }
 543                         else{
 544                                 if ((rights[i][j] == 6) | (rights[i][j] == 5)) {
 545                                         UsbCommand c = {CMD_MIFARE_READBL, {i*4+j, 1, 0}};
 546                                         memcpy(c.d.asBytes, keyB[i], 6);
 547                                         SendCommand(&c);
 548           received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
 549                                 }
 550                                 else if (rights[i][j] == 7) {
 551                                         PrintAndLog("Access rights do not allow reading of sector %d block %d",i,j);
 552                                 }
 553                                 else {
 554                                         UsbCommand c = {CMD_MIFARE_READBL, {i*4+j, 0, 0}};
 555                                         memcpy(c.d.asBytes, keyA[i], 6);
 556                                         SendCommand(&c);
 557           received = WaitForResponseTimeout(CMD_ACK,&resp,1500);
 558                                 }
 559                         }
 560
 561                         if (received) {
 562                                 uint8_t isOK  = resp.arg[0] & 0xff;
 563                                 uint8_t *data  = resp.d.asBytes;
 564                                 if (j == 3) {
 565                                         data[0]  = (keyA[i][0]);
 566                                         data[1]  = (keyA[i][1]);
 567                                         data[2]  = (keyA[i][2]);
 568                                         data[3]  = (keyA[i][3]);
 569                                         data[4]  = (keyA[i][4]);
 570                                         data[5]  = (keyA[i][5]);
 571                                         data[10] = (keyB[i][0]);
 572                                         data[11] = (keyB[i][1]);
 573                                         data[12] = (keyB[i][2]);
 574                                         data[13] = (keyB[i][3]);
 575                                         data[14] = (keyB[i][4]);
 576                                         data[15] = (keyB[i][5]);
 577                                 }
 578                                 if (isOK) {
 579                                         fwrite ( data, 1, 16, fout );
 580                     PrintAndLog("Dumped card data into 'dumpdata.bin'");
 581
 582                                 }
 583                                 else {
 584                                         PrintAndLog("Could not get access rights for block %d", i);
 585                                 }
 586                         }
 587                         else {
 588                                 PrintAndLog("Command execute timeout");
 589                         }
 590                 }
 591         }
 592
 593         fclose(fin);
 594         fclose(fout);
 595   return 0;
 596 }
 597
 598 int CmdHF14AMfRestore(const char *Cmd)
 599 {
 600
 601         int i,j;
 602         uint8_t keyType = 0;
 603         uint8_t key[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 604         uint8_t bldata[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
 605         uint8_t keyA[16][6];
 606         uint8_t keyB[16][6];
 607
 608         FILE *fdump;
 609         FILE *fkeys;
 610
 611         if ((fdump = fopen("dumpdata.bin","rb")) == NULL) {
 612                 PrintAndLog("Could not find file dumpdata.bin");
 613                 return 1;
 614         }
 615         if ((fkeys = fopen("dumpkeys.bin","rb")) == NULL) {
 616                 PrintAndLog("Could not find file dumpkeys.bin");
 617                 return 1;
 618         }
 619
 620         for (i=0 ; i<16 ; i++) {
 621                 if (fread(keyA[i], 1, 6, fkeys) == 0) {
 622       PrintAndLog("File reading error.");
 623                         return 2;
 624     }
 625         }
 626         for (i=0 ; i<16 ; i++) {
 627                 if (fread(keyB[i], 1, 6, fkeys) == 0) {
 628       PrintAndLog("File reading error.");
 629                         return 2;
 630     }
 631         }
 632
 633         PrintAndLog("Restoring dumpdata.bin to card");
 634
 635         for (i=0 ; i<16 ; i++) {
 636                 for( j=0 ; j<4 ; j++) {
 637                         UsbCommand c = {CMD_MIFARE_WRITEBL, {i*4 + j, keyType, 0}};
 638                         memcpy(c.d.asBytes, key, 6);
 639
 640                         if (fread(bldata, 1, 16, fdump) == 0) {
 641         PrintAndLog("File reading error.");
 642         return 2;
 643       }
 644
 645                         if (j == 3) {
 646                                 bldata[0]  = (keyA[i][0]);
 647                                 bldata[1]  = (keyA[i][1]);
 648                                 bldata[2]  = (keyA[i][2]);
 649                                 bldata[3]  = (keyA[i][3]);
 650                                 bldata[4]  = (keyA[i][4]);
 651                                 bldata[5]  = (keyA[i][5]);
 652                                 bldata[10] = (keyB[i][0]);
 653                                 bldata[11] = (keyB[i][1]);
 654                                 bldata[12] = (keyB[i][2]);
 655                                 bldata[13] = (keyB[i][3]);
 656                                 bldata[14] = (keyB[i][4]);
 657                                 bldata[15] = (keyB[i][5]);
 658                         }
 659
 660                         PrintAndLog("Writing to block %2d: %s", i*4+j, sprint_hex(bldata, 16));
 661
 662                         /*
 663                         PrintAndLog("Writing to block %2d: %s Confirm? [Y,N]", i*4+j, sprint_hex(bldata, 16));
 664
 665                         scanf("%c",&ch);
 666                         if ((ch != 'y') && (ch != 'Y')){
 667                                 PrintAndLog("Aborting !");
 668                                 return 1;
 669                         }
 670                         */
 671
 672                         memcpy(c.d.asBytes + 10, bldata, 16);
 673                         SendCommand(&c);
 674
 675                         UsbCommand resp;
 676       if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 677                                 uint8_t isOK  = resp.arg[0] & 0xff;
 678                                 PrintAndLog("isOk:%02x", isOK);
 679                         } else {
 680                                 PrintAndLog("Command execute timeout");
 681                         }
 682                 }
 683         }
 684
 685         fclose(fdump);
 686         fclose(fkeys);
 687         return 0;
 688 }
 689
 690 int CmdHF14AMfNested(const char *Cmd)
 691 {
 692         int i, j, res, iterations;
 693         sector  *       e_sector = NULL;
 694         uint8_t blockNo = 0;
 695         uint8_t keyType = 0;
 696         uint8_t trgBlockNo = 0;
 697         uint8_t trgKeyType = 0;
 698         uint8_t blDiff = 0;
 699         int  SectorsCnt = 0;
 700         uint8_t key[6] = {0, 0, 0, 0, 0, 0};
 701         uint8_t keyBlock[6*6];
 702         uint64_t key64 = 0;
 703         int transferToEml = 0;
 704
 705         int createDumpFile = 0;
 706         FILE *fkeys;
 707         uint8_t standart[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 708         uint8_t tempkey[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 709
 710         char cmdp, ctmp;
 711
 712         if (strlen(Cmd)<3) {
 713                 PrintAndLog("Usage:");
 714                 PrintAndLog(" all sectors:  hf mf nested  <card memory> <block number> <key A/B> <key (12 hex symbols)> [t,d]");
 715                 PrintAndLog(" one sector:   hf mf nested  o <block number> <key A/B> <key (12 hex symbols)>");
 716                 PrintAndLog("               <target block number> <target key A/B> [t]");
 717                 PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
 718                 PrintAndLog("t - transfer keys into emulator memory");
 719                 PrintAndLog("d - write keys to binary file");
 720                 PrintAndLog(" ");
 721                 PrintAndLog("      sample1: hf mf nested 1 0 A FFFFFFFFFFFF ");
 722                 PrintAndLog("      sample1: hf mf nested 1 0 A FFFFFFFFFFFF t ");
 723                 PrintAndLog("      sample1: hf mf nested 1 0 A FFFFFFFFFFFF d ");
 724                 PrintAndLog("      sample2: hf mf nested o 0 A FFFFFFFFFFFF 4 A");
 725                 return 0;
 726         }
 727
 728         cmdp = param_getchar(Cmd, 0);
 729         blockNo = param_get8(Cmd, 1);
 730         ctmp = param_getchar(Cmd, 2);
 731         if (ctmp == 0x00) {
 732                 PrintAndLog("Key type must be A or B");
 733                 return 1;
 734         }
 735         if (ctmp != 'A' && ctmp != 'a') keyType = 1;
 736         if (param_gethex(Cmd, 3, key, 12)) {
 737                 PrintAndLog("Key must include 12 HEX symbols");
 738                 return 1;
 739         }
 740
 741         if (cmdp == 'o' || cmdp == 'O') {
 742                 cmdp = 'o';
 743                 trgBlockNo = param_get8(Cmd, 4);
 744                 ctmp = param_getchar(Cmd, 5);
 745                 if (ctmp == 0x00) {
 746                         PrintAndLog("Target key type must be A or B");
 747                         return 1;
 748                 }
 749                 if (ctmp != 'A' && ctmp != 'a') trgKeyType = 1;
 750         } else {
 751                 switch (cmdp) {
 752                         case '0': SectorsCnt = 05; break;
 753                         case '1': SectorsCnt = 16; break;
 754                         case '2': SectorsCnt = 32; break;
 755                         case '4': SectorsCnt = 64; break;
 756                         default:  SectorsCnt = 16;
 757                 }
 758         }
 759
 760         ctmp = param_getchar(Cmd, 4);
 761         if              (ctmp == 't' || ctmp == 'T') transferToEml = 1;
 762         else if (ctmp == 'd' || ctmp == 'D') createDumpFile = 1;
 763
 764         ctmp = param_getchar(Cmd, 6);
 765         transferToEml |= (ctmp == 't' || ctmp == 'T');
 766         transferToEml |= (ctmp == 'd' || ctmp == 'D');
 767
 768         PrintAndLog("--block no:%02x key type:%02x key:%s etrans:%d", blockNo, keyType, sprint_hex(key, 6), transferToEml);
 769         if (cmdp == 'o')
 770                 PrintAndLog("--target block no:%02x target key type:%02x ", trgBlockNo, trgKeyType);
 771
 772         if (cmdp == 'o') {
 773                 if (mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true)) {
 774                         PrintAndLog("Nested error.");
 775                         return 2;
 776                 }
 777                 key64 = bytes_to_num(keyBlock, 6);
 778                 if (key64) {
 779                         PrintAndLog("Found valid key:%012"llx, key64);
 780
 781                         // transfer key to the emulator
 782                         if (transferToEml) {
 783                                 mfEmlGetMem(keyBlock, (trgBlockNo / 4) * 4 + 3, 1);
 784
 785                                 if (!trgKeyType)
 786                                         num_to_bytes(key64, 6, keyBlock);
 787                                 else
 788                                         num_to_bytes(key64, 6, &keyBlock[10]);
 789                                 mfEmlSetMem(keyBlock, (trgBlockNo / 4) * 4 + 3, 1);
 790                         }
 791                 } else {
 792                         PrintAndLog("No valid key found");
 793                 }
 794         }
 795         else { // ------------------------------------  multiple sectors working
 796                 clock_t time1;
 797                 time1 = clock();
 798
 799                 blDiff = blockNo % 4;
 800                 PrintAndLog("Block shift=%d", blDiff);
 801                 e_sector = calloc(SectorsCnt, sizeof(sector));
 802                 if (e_sector == NULL) return 1;
 803
 804                 //test current key 4 sectors
 805                 memcpy(keyBlock, key, 6);
 806                 num_to_bytes(0xffffffffffff, 6, (uint8_t*)(keyBlock + 1 * 6));
 807                 num_to_bytes(0x000000000000, 6, (uint8_t*)(keyBlock + 2 * 6));
 808                 num_to_bytes(0xa0a1a2a3a4a5, 6, (uint8_t*)(keyBlock + 3 * 6));
 809                 num_to_bytes(0xb0b1b2b3b4b5, 6, (uint8_t*)(keyBlock + 4 * 6));
 810                 num_to_bytes(0xaabbccddeeff, 6, (uint8_t*)(keyBlock + 5 * 6));
 811
 812                 PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);
 813                 for (i = 0; i < SectorsCnt; i++) {
 814                         for (j = 0; j < 2; j++) {
 815                                 if (e_sector[i].foundKey[j]) continue;
 816
 817                                 res = mfCheckKeys(i * 4 + blDiff, j, 6, keyBlock, &key64);
 818
 819                                 if (!res) {
 820                                         e_sector[i].Key[j] = key64;
 821                                         e_sector[i].foundKey[j] = 1;
 822                                 }
 823                         }
 824                 }
 825
 826
 827                 // nested sectors
 828                 iterations = 0;
 829                 PrintAndLog("nested...");
 830                 bool calibrate = true;
 831                 for (i = 0; i < NESTED_SECTOR_RETRY; i++) {
 832                         for (trgBlockNo = blDiff; trgBlockNo < SectorsCnt * 4; trgBlockNo = trgBlockNo + 4) {
 833                                 for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) {
 834                                         if (e_sector[trgBlockNo / 4].foundKey[trgKeyType]) continue;
 835                                         PrintAndLog("-----------------------------------------------");
 836                                         if(mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, calibrate)) {
 837                                                 PrintAndLog("Nested error.\n");
 838                                                 return 2;
 839                                         }
 840                                         else {
 841                                                 calibrate = false;
 842                                         }
 843
 844                                         iterations++;
 845
 846                                         key64 = bytes_to_num(keyBlock, 6);
 847                                         if (key64) {
 848                                                 PrintAndLog("Found valid key:%012"llx, key64);
 849                                                 e_sector[trgBlockNo / 4].foundKey[trgKeyType] = 1;
 850                                                 e_sector[trgBlockNo / 4].Key[trgKeyType] = key64;
 851                                         }
 852                                 }
 853                         }
 854                 }
 855
 856                 printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)clock() - time1)/CLOCKS_PER_SEC, ((float)clock() - time1)/iterations/CLOCKS_PER_SEC);
 857
 858                 PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations);
 859                 //print them
 860                 PrintAndLog("|---|----------------|---|----------------|---|");
 861                 PrintAndLog("|sec|key A           |res|key B           |res|");
 862                 PrintAndLog("|---|----------------|---|----------------|---|");
 863                 for (i = 0; i < SectorsCnt; i++) {
 864                         PrintAndLog("|%03d|  %012"llx"  | %d |  %012"llx"  | %d |", i,
 865                                 e_sector[i].Key[0], e_sector[i].foundKey[0], e_sector[i].Key[1], e_sector[i].foundKey[1]);
 866                 }
 867                 PrintAndLog("|---|----------------|---|----------------|---|");
 868
 869                 // transfer them to the emulator
 870                 if (transferToEml) {
 871                         for (i = 0; i < SectorsCnt; i++) {
 872                                 mfEmlGetMem(keyBlock, i * 4 + 3, 1);
 873                                 if (e_sector[i].foundKey[0])
 874                                         num_to_bytes(e_sector[i].Key[0], 6, keyBlock);
 875                                 if (e_sector[i].foundKey[1])
 876                                         num_to_bytes(e_sector[i].Key[1], 6, &keyBlock[10]);
 877                                 mfEmlSetMem(keyBlock, i * 4 + 3, 1);
 878                         }
 879                 }
 880
 881                 // Create dump file
 882                 if (createDumpFile) {
 883                         if ((fkeys = fopen("dumpkeys.bin","wb")) == NULL) {
 884                                 PrintAndLog("Could not create file dumpkeys.bin");
 885                                 free(e_sector);
 886                                 return 1;
 887                         }
 888                         PrintAndLog("Printing keys to bynary file dumpkeys.bin...");
 889                         for(i=0; i<16; i++) {
 890                                 if (e_sector[i].foundKey[0]){
 891                                         num_to_bytes(e_sector[i].Key[0], 6, tempkey);
 892                                         fwrite ( tempkey, 1, 6, fkeys );
 893                                 }
 894                                 else{
 895                                         fwrite ( &standart, 1, 6, fkeys );
 896                                 }
 897                         }
 898                         for(i=0; i<16; i++) {
 899                                 if (e_sector[i].foundKey[1]){
 900                                         num_to_bytes(e_sector[i].Key[1], 6, tempkey);
 901                                         fwrite ( tempkey, 1, 6, fkeys );
 902                                 }
 903                                 else{
 904                                         fwrite ( &standart, 1, 6, fkeys );
 905                                 }
 906                         }
 907                         fclose(fkeys);
 908                 }
 909
 910                 free(e_sector);
 911         }
 912
 913         return 0;
 914 }
 915
 916 static  uint32_t
 917 get_trailer_block (uint32_t uiBlock)
 918 {
 919   // Test if we are in the small or big sectors
 920   uint32_t trailer_block = 0;
 921   if (uiBlock < 128) {
 922     trailer_block = uiBlock + (3 - (uiBlock % 4));
 923   } else {
 924     trailer_block = uiBlock + (15 - (uiBlock % 16));
 925   }
 926   return trailer_block;
 927 }
 928 int CmdHF14AMfChk(const char *Cmd)
 929 {
 930         FILE * f;
 931         char filename[256]={0};
 932         char buf[13];
 933         uint8_t *keyBlock = NULL, *p;
 934         uint8_t stKeyBlock = 20;
 935
 936         int i, res;
 937         int     keycnt = 0;
 938         char ctmp       = 0x00;
 939         uint8_t blockNo = 0;
 940         uint8_t SectorsCnt = 1;
 941         uint8_t keyType = 0;
 942         uint64_t key64 = 0;
 943
 944         int transferToEml = 0;
 945         int createDumpFile = 0;
 946
 947         keyBlock = calloc(stKeyBlock, 6);
 948         if (keyBlock == NULL) return 1;
 949
 950         uint64_t defaultKeys[] =
 951         {
 952                 0xffffffffffff, // Default key (first key used by program if no user defined key)
 953                 0x000000000000, // Blank key
 954                 0xa0a1a2a3a4a5, // NFCForum MAD key
 955                 0xb0b1b2b3b4b5,
 956                 0xaabbccddeeff,
 957                 0x4d3a99c351dd,
 958                 0x1a982c7e459a,
 959                 0xd3f7d3f7d3f7,
 960                 0x714c5c886e97,
 961                 0x587ee5f9350f,
 962                 0xa0478cc39091,
 963                 0x533cb6c723f6,
 964                 0x8fd0a4f256e9
 965         };
 966         int defaultKeysSize = (sizeof(defaultKeys) / 7) - 1;
 967
 968         for (int defaultKeyCounter = 0; defaultKeyCounter < defaultKeysSize; defaultKeyCounter++)
 969         {
 970                 num_to_bytes(defaultKeys[defaultKeyCounter], 6, (uint8_t*)(keyBlock + defaultKeyCounter * 6));
 971         }
 972
 973         if (strlen(Cmd)<3) {
 974                 PrintAndLog("Usage:  hf mf chk <block number>/<*card memory> <key type (A/B/?)> [t] [<key (12 hex symbols)>] [<dic (*.dic)>]");
 975                 PrintAndLog("          * - all sectors");
 976                 PrintAndLog("card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
 977 //              PrintAndLog("d - write keys to binary file\n");
 978
 979                 PrintAndLog("      sample: hf mf chk 0 A 1234567890ab keys.dic");
 980                 PrintAndLog("              hf mf chk *1 ? t");
 981                 return 0;
 982         }
 983
 984         if (param_getchar(Cmd, 0)=='*') {
 985                 blockNo = 3;
 986                 switch(param_getchar(Cmd+1, 0)) {
 987                         case '0': SectorsCnt =  5; break;
 988                         case '1': SectorsCnt = 16; break;
 989                         case '2': SectorsCnt = 32; break;
 990                         case '4': SectorsCnt = 40; break;
 991                         default:  SectorsCnt = 16;
 992                 }
 993         }
 994         else
 995                 blockNo = param_get8(Cmd, 0);
 996
 997         ctmp = param_getchar(Cmd, 1);
 998         switch (ctmp) {
 999         case 'a': case 'A':
1000                 keyType = !0;
1001                 break;
1002         case 'b': case 'B':
1003                 keyType = !1;
1004                 break;
1005         case '?':
1006                 keyType = 2;
1007                 break;
1008         default:
1009                 PrintAndLog("Key type must be A , B or ?");
1010                 return 1;
1011         };
1012
1013         ctmp = param_getchar(Cmd, 2);
1014         if              (ctmp == 't' || ctmp == 'T') transferToEml = 1;
1015         else if (ctmp == 'd' || ctmp == 'D') createDumpFile = 1;
1016
1017         for (i = transferToEml || createDumpFile; param_getchar(Cmd, 2 + i); i++) {
1018                 if (!param_gethex(Cmd, 2 + i, keyBlock + 6 * keycnt, 12)) {
1019                         if ( stKeyBlock - keycnt < 2) {
1020                                 p = realloc(keyBlock, 6*(stKeyBlock+=10));
1021                                 if (!p) {
1022                                         PrintAndLog("Cannot allocate memory for Keys");
1023                                         free(keyBlock);
1024                                         return 2;
1025                                 }
1026                                 keyBlock = p;
1027                         }
1028                         PrintAndLog("chk key[%d] %02x%02x%02x%02x%02x%02x", keycnt,
1029                         (keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2],
1030                         (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4],     (keyBlock + 6*keycnt)[5], 6);
1031                         keycnt++;
1032                 } else {
1033                         // May be a dic file
1034                         if ( param_getstr(Cmd, 2 + i,filename) > 255 ) {
1035                                 PrintAndLog("File name too long");
1036                                 free(keyBlock);
1037                                 return 2;
1038                         }
1039
1040                         if ( (f = fopen( filename , "r")) ) {
1041                                 while( fgets(buf, sizeof(buf), f) ){
1042                                         if (strlen(buf) < 12 || buf[11] == '\n')
1043                                                 continue;
1044
1045                                         while (fgetc(f) != '\n' && !feof(f)) ;  //goto next line
1046
1047                                         if( buf[0]=='#' ) continue;     //The line start with # is comment, skip
1048
1049                                         if (!isxdigit(buf[0])){
1050                                                 PrintAndLog("File content error. '%s' must include 12 HEX symbols",buf);
1051                                                 continue;
1052                                         }
1053
1054                                         buf[12] = 0;
1055
1056                                         if ( stKeyBlock - keycnt < 2) {
1057                                                 p = realloc(keyBlock, 6*(stKeyBlock+=10));
1058                                                 if (!p) {
1059                                                         PrintAndLog("Cannot allocate memory for defKeys");
1060                                                         free(keyBlock);
1061                                                         return 2;
1062                                                 }
1063                                                 keyBlock = p;
1064                                         }
1065                                         memset(keyBlock + 6 * keycnt, 0, 6);
1066                                         num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + 6*keycnt);
1067                                         PrintAndLog("chk custom key[%d] %012"llx, keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));
1068                                         keycnt++;
1069                                         memset(buf, 0, sizeof(buf));
1070                                 }
1071                         } else {
1072                                 PrintAndLog("File: %s: not found or locked.", filename);
1073                                 free(keyBlock);
1074                                 return 1;
1075                         fclose(f);
1076                         }
1077                 }
1078         }
1079
1080         if (keycnt == 0) {
1081                 PrintAndLog("No key specified,try default keys");
1082                 for (;keycnt < defaultKeysSize; keycnt++)
1083                         PrintAndLog("chk default key[%d] %02x%02x%02x%02x%02x%02x", keycnt,
1084                         (keyBlock + 6*keycnt)[0],(keyBlock + 6*keycnt)[1], (keyBlock + 6*keycnt)[2],
1085                         (keyBlock + 6*keycnt)[3], (keyBlock + 6*keycnt)[4],     (keyBlock + 6*keycnt)[5], 6);
1086         }
1087
1088         for ( int t = !keyType ; t < 2 ; keyType==2?(t++):(t=2) ) {
1089                 int b=blockNo;
1090                 for (int i=0; i<SectorsCnt; ++i) {
1091                         PrintAndLog("--SectorsCnt:%d block no:0x%02x key type:%C key count:%d ", i,      b, t?'B':'A', keycnt);
1092                         uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt;
1093                         for (uint32_t c = 0; c < keycnt; c+=max_keys) {
1094                                 uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c;
1095                                 res = mfCheckKeys(b, t, size, &keyBlock[6*c], &key64);
1096                                 if (res !=1) {
1097                                         if (!res) {
1098                                                 PrintAndLog("Found valid key:[%012"llx"]",key64);
1099                                                 if (transferToEml) {
1100                                                         uint8_t block[16];
1101                                                         mfEmlGetMem(block, get_trailer_block(b), 1);
1102                                                         num_to_bytes(key64, 6, block + t*10);
1103                                                         mfEmlSetMem(block, get_trailer_block(b), 1);
1104                                                 }
1105                                         }
1106                                 } else {
1107                                         PrintAndLog("Command execute timeout");
1108                                 }
1109                         }
1110                         b<127?(b+=4):(b+=16);
1111                 }
1112         }
1113
1114         free(keyBlock);
1115
1116 /*
1117         // Create dump file
1118         if (createDumpFile) {
1119                 if ((fkeys = fopen("dumpkeys.bin","wb")) == NULL) {
1120                         PrintAndLog("Could not create file dumpkeys.bin");
1121                         free(e_sector);
1122                         return 1;
1123                 }
1124                 PrintAndLog("Printing keys to bynary file dumpkeys.bin...");
1125                 for(i=0; i<16; i++) {
1126                         if (e_sector[i].foundKey[0]){
1127                                 num_to_bytes(e_sector[i].Key[0], 6, tempkey);
1128                                 fwrite ( tempkey, 1, 6, fkeys );
1129                         }
1130                         else{
1131                                 fwrite ( &standart, 1, 6, fkeys );
1132                         }
1133                 }
1134                 for(i=0; i<16; i++) {
1135                         if (e_sector[i].foundKey[1]){
1136                                 num_to_bytes(e_sector[i].Key[1], 6, tempkey);
1137                                 fwrite ( tempkey, 1, 6, fkeys );
1138                         }
1139                         else{
1140                                 fwrite ( &standart, 1, 6, fkeys );
1141                         }
1142                 }
1143                 fclose(fkeys);
1144         }
1145 */
1146   return 0;
1147 }
1148
1149 int CmdHF14AMf1kSim(const char *Cmd)
1150 {
1151         uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0};
1152         uint8_t exitAfterNReads = 0;
1153         uint8_t flags = 0;
1154
1155         if (param_getchar(Cmd, 0) == 'h') {
1156                 PrintAndLog("Usage:  hf mf sim  u <uid (8 hex symbols)> n <numreads> i x");
1157                 PrintAndLog("           u    (Optional) UID. If not specified, the UID from emulator memory will be used");
1158                 PrintAndLog("           n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");
1159                 PrintAndLog("           i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");
1160                 PrintAndLog("           x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a legitimate reader, fishes out the key(s)");
1161                 PrintAndLog("           sample: hf mf sim 0a0a0a0a ");
1162                 return 0;
1163         }
1164         uint8_t pnr = 0;
1165         if (param_getchar(Cmd, pnr) == 'u') {
1166                 if(param_gethex(Cmd, pnr+1, uid, 8) == 0)
1167                 {
1168                         flags |=FLAG_4B_UID_IN_DATA; // UID from packet
1169                 }else if(param_gethex(Cmd,pnr+1,uid,14) == 0)
1170                 {
1171                         flags |= FLAG_7B_UID_IN_DATA;// UID from packet
1172                 }else
1173                 {
1174                                 PrintAndLog("UID, if specified, must include 8 or 14 HEX symbols");
1175                                 return 1;
1176                 }
1177                 pnr +=2;
1178         }
1179         if (param_getchar(Cmd, pnr) == 'n') {
1180                 exitAfterNReads = param_get8(Cmd,pnr+1);
1181                 pnr += 2;
1182         }
1183         if (param_getchar(Cmd, pnr) == 'i' ) {
1184                 //Using a flag to signal interactiveness, least significant bit
1185                 flags |= FLAG_INTERACTIVE;
1186                 pnr++;
1187         }
1188
1189         if (param_getchar(Cmd, pnr) == 'x' ) {
1190                 //Using a flag to signal interactiveness, least significant bit
1191                 flags |= FLAG_NR_AR_ATTACK;
1192         }
1193         PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) ",
1194                                 flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):
1195                                                                                           flags & FLAG_7B_UID_IN_DATA   ? sprint_hex(uid,7): "N/A"
1196                                 , exitAfterNReads, flags,flags);
1197
1198
1199   UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};
1200   memcpy(c.d.asBytes, uid, sizeof(uid));
1201   SendCommand(&c);
1202
1203   if(flags & FLAG_INTERACTIVE)
1204   {
1205           UsbCommand resp;
1206           PrintAndLog("Press pm3-button to abort simulation");
1207           while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
1208                 //We're waiting only 1.5 s at a time, otherwise we get the
1209                   // annoying message about "Waiting for a response... "
1210           }
1211   }
1212
1213   return 0;
1214 }
1215
1216 int CmdHF14AMfDbg(const char *Cmd)
1217 {
1218         int dbgMode = param_get32ex(Cmd, 0, 0, 10);
1219         if (dbgMode > 4) {
1220                 PrintAndLog("Max debud mode parameter is 4 \n");
1221         }
1222
1223         if (strlen(Cmd) < 1 || !param_getchar(Cmd, 0) || dbgMode > 4) {
1224                 PrintAndLog("Usage:  hf mf dbg  <debug level>");
1225                 PrintAndLog(" 0 - no debug messages");
1226                 PrintAndLog(" 1 - error messages");
1227                 PrintAndLog(" 2 - all messages");
1228                 PrintAndLog(" 4 - extended debug mode");
1229                 return 0;
1230         }
1231
1232   UsbCommand c = {CMD_MIFARE_SET_DBGMODE, {dbgMode, 0, 0}};
1233   SendCommand(&c);
1234
1235   return 0;
1236 }
1237
1238 int CmdHF14AMfEGet(const char *Cmd)
1239 {
1240         uint8_t blockNo = 0;
1241         uint8_t data[3 * 16];
1242         int i;
1243
1244         if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
1245                 PrintAndLog("Usage:  hf mf eget <block number>");
1246                 PrintAndLog(" sample: hf mf eget 0 ");
1247                 return 0;
1248         }
1249
1250         blockNo = param_get8(Cmd, 0);
1251
1252         PrintAndLog(" ");
1253         if (!mfEmlGetMem(data, blockNo, 3)) {
1254                 for (i = 0; i < 3; i++) {
1255                         PrintAndLog("data[%d]:%s", blockNo + i, sprint_hex(data + i * 16, 16));
1256                 }
1257         } else {
1258                 PrintAndLog("Command execute timeout");
1259         }
1260
1261   return 0;
1262 }
1263
1264 int CmdHF14AMfEClear(const char *Cmd)
1265 {
1266         if (param_getchar(Cmd, 0) == 'h') {
1267                 PrintAndLog("Usage:  hf mf eclr");
1268                 PrintAndLog("It set card emulator memory to empty data blocks and key A/B FFFFFFFFFFFF \n");
1269                 return 0;
1270         }
1271
1272   UsbCommand c = {CMD_MIFARE_EML_MEMCLR, {0, 0, 0}};
1273   SendCommand(&c);
1274   return 0;
1275 }
1276
1277 int CmdHF14AMfESet(const char *Cmd)
1278 {
1279         uint8_t memBlock[16];
1280         uint8_t blockNo = 0;
1281
1282         memset(memBlock, 0x00, sizeof(memBlock));
1283
1284         if (strlen(Cmd) < 3 || param_getchar(Cmd, 0) == 'h') {
1285                 PrintAndLog("Usage:  hf mf eset <block number> <block data (32 hex symbols)>");
1286                 PrintAndLog(" sample: hf mf eset 1 000102030405060708090a0b0c0d0e0f ");
1287                 return 0;
1288         }
1289
1290         blockNo = param_get8(Cmd, 0);
1291
1292         if (param_gethex(Cmd, 1, memBlock, 32)) {
1293                 PrintAndLog("block data must include 32 HEX symbols");
1294                 return 1;
1295         }
1296
1297         //  1 - blocks count
1298   UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNo, 1, 0}};
1299         memcpy(c.d.asBytes, memBlock, 16);
1300   SendCommand(&c);
1301   return 0;
1302 }
1303
1304 int CmdHF14AMfELoad(const char *Cmd)
1305 {
1306         FILE * f;
1307         char filename[20];
1308         char * fnameptr = filename;
1309         char buf[64];
1310         uint8_t buf8[64];
1311         int i, len, blockNum;
1312
1313         memset(filename, 0, sizeof(filename));
1314         memset(buf, 0, sizeof(buf));
1315
1316         if (param_getchar(Cmd, 0) == 'h' || param_getchar(Cmd, 0)== 0x00) {
1317                 PrintAndLog("It loads emul dump from the file `filename.eml`");
1318                 PrintAndLog("Usage:  hf mf eload <file name w/o `.eml`>");
1319                 PrintAndLog(" sample: hf mf eload filename");
1320                 return 0;
1321         }
1322
1323         len = strlen(Cmd);
1324         if (len > 14) len = 14;
1325
1326         memcpy(filename, Cmd, len);
1327         fnameptr += len;
1328
1329         sprintf(fnameptr, ".eml");
1330
1331         // open file
1332         f = fopen(filename, "r");
1333         if (f == NULL) {
1334                 PrintAndLog("File not found or locked.");
1335                 return 1;
1336         }
1337
1338         blockNum = 0;
1339         while(!feof(f)){
1340                 memset(buf, 0, sizeof(buf));
1341                 if (fgets(buf, sizeof(buf), f) == NULL) {
1342                         if(blockNum == 16 * 4)
1343                         {
1344                                 break;
1345                         }
1346                         PrintAndLog("File reading error.");
1347                         return 2;
1348     }
1349
1350                 if (strlen(buf) < 32){
1351                         if(strlen(buf) && feof(f))
1352                                 break;
1353                         PrintAndLog("File content error. Block data must include 32 HEX symbols");
1354                         return 2;
1355                 }
1356                 for (i = 0; i < 32; i += 2)
1357                   sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);
1358 //                      PrintAndLog("data[%02d]:%s", blockNum, sprint_hex(buf8, 16));
1359
1360                 if (mfEmlSetMem(buf8, blockNum, 1)) {
1361                         PrintAndLog("Cant set emul block: %d", blockNum);
1362                         return 3;
1363                 }
1364                 blockNum++;
1365
1366                 if (blockNum >= 32 * 4 + 8 * 16) break;
1367         }
1368         fclose(f);
1369
1370         if (blockNum != 16 * 4 && blockNum != 32 * 4 + 8 * 16){
1371                 PrintAndLog("File content error. There must be 64 blocks");
1372                 return 4;
1373         }
1374         PrintAndLog("Loaded %d blocks from file: %s", blockNum, filename);
1375   return 0;
1376 }
1377
1378 int CmdHF14AMfESave(const char *Cmd)
1379 {
1380         FILE * f;
1381         char filename[20];
1382         char * fnameptr = filename;
1383         uint8_t buf[64];
1384         int i, j, len;
1385
1386         memset(filename, 0, sizeof(filename));
1387         memset(buf, 0, sizeof(buf));
1388
1389         if (param_getchar(Cmd, 0) == 'h') {
1390                 PrintAndLog("It saves emul dump into the file `filename.eml` or `cardID.eml`");
1391                 PrintAndLog("Usage:  hf mf esave [file name w/o `.eml`]");
1392                 PrintAndLog(" sample: hf mf esave ");
1393                 PrintAndLog("         hf mf esave filename");
1394                 return 0;
1395         }
1396
1397         len = strlen(Cmd);
1398         if (len > 14) len = 14;
1399
1400         if (len < 1) {
1401                 // get filename
1402                 if (mfEmlGetMem(buf, 0, 1)) {
1403                         PrintAndLog("Cant get block: %d", 0);
1404                         return 1;
1405                 }
1406                 for (j = 0; j < 7; j++, fnameptr += 2)
1407                         sprintf(fnameptr, "%02x", buf[j]);
1408         } else {
1409                 memcpy(filename, Cmd, len);
1410                 fnameptr += len;
1411         }
1412
1413         sprintf(fnameptr, ".eml");
1414
1415         // open file
1416         f = fopen(filename, "w+");
1417
1418         // put hex
1419         for (i = 0; i < 32 * 4 + 8 * 16; i++) {
1420                 if (mfEmlGetMem(buf, i, 1)) {
1421                         PrintAndLog("Cant get block: %d", i);
1422                         break;
1423                 }
1424                 for (j = 0; j < 16; j++)
1425                         fprintf(f, "%02x", buf[j]);
1426                 fprintf(f,"\n");
1427         }
1428         fclose(f);
1429
1430         PrintAndLog("Saved to file: %s", filename);
1431
1432   return 0;
1433 }
1434
1435 int CmdHF14AMfECFill(const char *Cmd)
1436 {
1437         uint8_t keyType = 0;
1438
1439         if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
1440                 PrintAndLog("Usage:  hf mf efill <key A/B>");
1441                 PrintAndLog("sample:  hf mf efill A");
1442                 PrintAndLog("Card data blocks transfers to card emulator memory.");
1443                 PrintAndLog("Keys must be laid in the simulator memory. \n");
1444                 return 0;
1445         }
1446
1447         char ctmp = param_getchar(Cmd, 0);
1448         if (ctmp == 0x00) {
1449                 PrintAndLog("Key type must be A or B");
1450                 return 1;
1451         }
1452         if (ctmp != 'A' && ctmp != 'a') keyType = 1;
1453
1454   UsbCommand c = {CMD_MIFARE_EML_CARDLOAD, {0, keyType, 0}};
1455   SendCommand(&c);
1456   return 0;
1457 }
1458
1459 int CmdHF14AMfEKeyPrn(const char *Cmd)
1460 {
1461         int i,b=-1;
1462         uint8_t data[16];
1463         uint64_t keyA, keyB;
1464
1465         PrintAndLog("|---|----------------|----------------|");
1466         PrintAndLog("|sec|key A           |key B           |");
1467         PrintAndLog("|---|----------------|----------------|");
1468         for (i = 0; i < 40; i++) {
1469                 b<127?(b+=4):(b+=16);
1470                 if (mfEmlGetMem(data, b, 1)) {
1471                         PrintAndLog("error get block %d", b);
1472                         break;
1473                 }
1474                 keyA = bytes_to_num(data, 6);
1475                 keyB = bytes_to_num(data + 10, 6);
1476                 PrintAndLog("|%03d|  %012"llx"  |  %012"llx"  |", i, keyA, keyB);
1477         }
1478         PrintAndLog("|---|----------------|----------------|");
1479
1480         return 0;
1481 }
1482
1483 int CmdHF14AMfCSetUID(const char *Cmd)
1484 {
1485         uint8_t wipeCard = 0;
1486         uint8_t uid[8];
1487         uint8_t oldUid[8];
1488         int res;
1489
1490         if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
1491                 PrintAndLog("Usage:  hf mf csetuid <UID 8 hex symbols> <w>");
1492                 PrintAndLog("sample:  hf mf csetuid 01020304 w");
1493                 PrintAndLog("Set UID for magic Chinese card (only works with!!!)");
1494                 PrintAndLog("If you want wipe card then add 'w' into command line. \n");
1495                 return 0;
1496         }
1497
1498         if (param_getchar(Cmd, 0) && param_gethex(Cmd, 0, uid, 8)) {
1499                 PrintAndLog("UID must include 8 HEX symbols");
1500                 return 1;
1501         }
1502
1503         char ctmp = param_getchar(Cmd, 1);
1504         if (ctmp == 'w' || ctmp == 'W') wipeCard = 1;
1505
1506         PrintAndLog("--wipe card:%02x uid:%s", wipeCard, sprint_hex(uid, 4));
1507
1508         res = mfCSetUID(uid, oldUid, wipeCard);
1509         if (res) {
1510                         PrintAndLog("Can't set UID. error=%d", res);
1511                         return 1;
1512                 }
1513
1514         PrintAndLog("old UID:%s", sprint_hex(oldUid, 4));
1515         return 0;
1516 }
1517
1518 int CmdHF14AMfCSetBlk(const char *Cmd)
1519 {
1520         uint8_t uid[8];
1521         uint8_t memBlock[16];
1522         uint8_t blockNo = 0;
1523         int res;
1524         memset(memBlock, 0x00, sizeof(memBlock));
1525
1526         if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
1527                 PrintAndLog("Usage:  hf mf csetblk <block number> <block data (32 hex symbols)>");
1528                 PrintAndLog("sample:  hf mf csetblk 1 01020304050607080910111213141516");
1529                 PrintAndLog("Set block data for magic Chinese card (only works with!!!)");
1530                 PrintAndLog("If you want wipe card then add 'w' into command line. \n");
1531                 return 0;
1532         }
1533
1534         blockNo = param_get8(Cmd, 0);
1535
1536         if (param_gethex(Cmd, 1, memBlock, 32)) {
1537                 PrintAndLog("block data must include 32 HEX symbols");
1538                 return 1;
1539         }
1540
1541         PrintAndLog("--block number:%02x data:%s", blockNo, sprint_hex(memBlock, 16));
1542
1543         res = mfCSetBlock(blockNo, memBlock, uid, 0, CSETBLOCK_SINGLE_OPER);
1544         if (res) {
1545                         PrintAndLog("Can't write block. error=%d", res);
1546                         return 1;
1547                 }
1548
1549         PrintAndLog("UID:%s", sprint_hex(uid, 4));
1550         return 0;
1551 }
1552
1553 int CmdHF14AMfCLoad(const char *Cmd)
1554 {
1555         FILE * f;
1556         char filename[20];
1557         char * fnameptr = filename;
1558         char buf[64];
1559         uint8_t buf8[64];
1560         uint8_t fillFromEmulator = 0;
1561         int i, len, blockNum, flags;
1562
1563         memset(filename, 0, sizeof(filename));
1564         memset(buf, 0, sizeof(buf));
1565
1566         if (param_getchar(Cmd, 0) == 'h' || param_getchar(Cmd, 0)== 0x00) {
1567                 PrintAndLog("It loads magic Chinese card (only works with!!!) from the file `filename.eml`");
1568                 PrintAndLog("or from emulator memory (option `e`)");
1569                 PrintAndLog("Usage:  hf mf cload <file name w/o `.eml`>");
1570                 PrintAndLog("   or:  hf mf cload e ");
1571                 PrintAndLog(" sample: hf mf cload filename");
1572                 return 0;
1573         }
1574
1575         char ctmp = param_getchar(Cmd, 0);
1576         if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;
1577
1578         if (fillFromEmulator) {
1579                 flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;
1580                 for (blockNum = 0; blockNum < 16 * 4; blockNum += 1) {
1581                         if (mfEmlGetMem(buf8, blockNum, 1)) {
1582                                 PrintAndLog("Cant get block: %d", blockNum);
1583                                 return 2;
1584                         }
1585
1586                         if (blockNum == 2) flags = 0;
1587                         if (blockNum == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;
1588
1589                         if (mfCSetBlock(blockNum, buf8, NULL, 0, flags)) {
1590                                 PrintAndLog("Cant set magic card block: %d", blockNum);
1591                                 return 3;
1592                         }
1593                 }
1594                 return 0;
1595         } else {
1596                 len = strlen(Cmd);
1597                 if (len > 14) len = 14;
1598
1599                 memcpy(filename, Cmd, len);
1600                 fnameptr += len;
1601
1602                 sprintf(fnameptr, ".eml");
1603
1604                 // open file
1605                 f = fopen(filename, "r");
1606                 if (f == NULL) {
1607                         PrintAndLog("File not found or locked.");
1608                         return 1;
1609                 }
1610
1611                 blockNum = 0;
1612                 flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;
1613                 while(!feof(f)){
1614                         memset(buf, 0, sizeof(buf));
1615                         if (fgets(buf, sizeof(buf), f) == NULL) {
1616         PrintAndLog("File reading error.");
1617         return 2;
1618       }
1619
1620                         if (strlen(buf) < 32){
1621                                 if(strlen(buf) && feof(f))
1622                                         break;
1623                                 PrintAndLog("File content error. Block data must include 32 HEX symbols");
1624                                 return 2;
1625                         }
1626                         for (i = 0; i < 32; i += 2)
1627                                 sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);
1628
1629                         if (blockNum == 2) flags = 0;
1630                         if (blockNum == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;
1631
1632                         if (mfCSetBlock(blockNum, buf8, NULL, 0, flags)) {
1633                                 PrintAndLog("Cant set magic card block: %d", blockNum);
1634                                 return 3;
1635                         }
1636                         blockNum++;
1637
1638                         if (blockNum >= 16 * 4) break;  // magic card type - mifare 1K
1639                 }
1640                 fclose(f);
1641
1642                 if (blockNum != 16 * 4 && blockNum != 32 * 4 + 8 * 16){
1643                         PrintAndLog("File content error. There must be 64 blocks");
1644                         return 4;
1645                 }
1646                 PrintAndLog("Loaded from file: %s", filename);
1647                 return 0;
1648         }
1649 }
1650
1651 int CmdHF14AMfCGetBlk(const char *Cmd) {
1652         uint8_t memBlock[16];
1653         uint8_t blockNo = 0;
1654         int res;
1655         memset(memBlock, 0x00, sizeof(memBlock));
1656
1657         if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
1658                 PrintAndLog("Usage:  hf mf cgetblk <block number>");
1659                 PrintAndLog("sample:  hf mf cgetblk 1");
1660                 PrintAndLog("Get block data from magic Chinese card (only works with!!!)\n");
1661                 return 0;
1662         }
1663
1664         blockNo = param_get8(Cmd, 0);
1665
1666         PrintAndLog("--block number:%02x ", blockNo);
1667
1668         res = mfCGetBlock(blockNo, memBlock, CSETBLOCK_SINGLE_OPER);
1669         if (res) {
1670                         PrintAndLog("Can't read block. error=%d", res);
1671                         return 1;
1672                 }
1673
1674         PrintAndLog("block data:%s", sprint_hex(memBlock, 16));
1675         return 0;
1676 }
1677
1678 int CmdHF14AMfCGetSc(const char *Cmd) {
1679         uint8_t memBlock[16];
1680         uint8_t sectorNo = 0;
1681         int i, res, flags;
1682         memset(memBlock, 0x00, sizeof(memBlock));
1683
1684         if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {
1685                 PrintAndLog("Usage:  hf mf cgetsc <sector number>");
1686                 PrintAndLog("sample:  hf mf cgetsc 0");
1687                 PrintAndLog("Get sector data from magic Chinese card (only works with!!!)\n");
1688                 return 0;
1689         }
1690
1691         sectorNo = param_get8(Cmd, 0);
1692         if (sectorNo > 15) {
1693                 PrintAndLog("Sector number must be in [0..15] as in MIFARE classic.");
1694                 return 1;
1695         }
1696
1697         PrintAndLog("--sector number:%02x ", sectorNo);
1698
1699         flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;
1700         for (i = 0; i < 4; i++) {
1701                 if (i == 1) flags = 0;
1702                 if (i == 3) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;
1703
1704                 res = mfCGetBlock(sectorNo * 4 + i, memBlock, flags);
1705                 if (res) {
1706                         PrintAndLog("Can't read block. %02x error=%d", sectorNo * 4 + i, res);
1707                         return 1;
1708                 }
1709
1710                 PrintAndLog("block %02x data:%s", sectorNo * 4 + i, sprint_hex(memBlock, 16));
1711         }
1712         return 0;
1713 }
1714
1715 int CmdHF14AMfCSave(const char *Cmd) {
1716
1717         FILE * f;
1718         char filename[20];
1719         char * fnameptr = filename;
1720         uint8_t fillFromEmulator = 0;
1721         uint8_t buf[64];
1722         int i, j, len, flags;
1723
1724         memset(filename, 0, sizeof(filename));
1725         memset(buf, 0, sizeof(buf));
1726
1727         if (param_getchar(Cmd, 0) == 'h') {
1728                 PrintAndLog("It saves `magic Chinese` card dump into the file `filename.eml` or `cardID.eml`");
1729                 PrintAndLog("or into emulator memory (option `e`)");
1730                 PrintAndLog("Usage:  hf mf esave [file name w/o `.eml`][e]");
1731                 PrintAndLog(" sample: hf mf esave ");
1732                 PrintAndLog("         hf mf esave filename");
1733                 PrintAndLog("         hf mf esave e \n");
1734                 return 0;
1735         }
1736
1737         char ctmp = param_getchar(Cmd, 0);
1738         if (ctmp == 'e' || ctmp == 'E') fillFromEmulator = 1;
1739
1740         if (fillFromEmulator) {
1741                 // put into emulator
1742                 flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;
1743                 for (i = 0; i < 16 * 4; i++) {
1744                         if (i == 1) flags = 0;
1745                         if (i == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;
1746
1747                         if (mfCGetBlock(i, buf, flags)) {
1748                                 PrintAndLog("Cant get block: %d", i);
1749                                 break;
1750                         }
1751
1752                         if (mfEmlSetMem(buf, i, 1)) {
1753                                 PrintAndLog("Cant set emul block: %d", i);
1754                                 return 3;
1755                         }
1756                 }
1757                 return 0;
1758         } else {
1759                 len = strlen(Cmd);
1760                 if (len > 14) len = 14;
1761
1762                 if (len < 1) {
1763                         // get filename
1764                         if (mfCGetBlock(0, buf, CSETBLOCK_SINGLE_OPER)) {
1765                                 PrintAndLog("Cant get block: %d", 0);
1766                                 return 1;
1767                         }
1768                         for (j = 0; j < 7; j++, fnameptr += 2)
1769                                 sprintf(fnameptr, "%02x", buf[j]);
1770                 } else {
1771                         memcpy(filename, Cmd, len);
1772                         fnameptr += len;
1773                 }
1774
1775                 sprintf(fnameptr, ".eml");
1776
1777                 // open file
1778                 f = fopen(filename, "w+");
1779
1780                 // put hex
1781                 flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC;
1782                 for (i = 0; i < 16 * 4; i++) {
1783                         if (i == 1) flags = 0;
1784                         if (i == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD;
1785
1786                         if (mfCGetBlock(i, buf, flags)) {
1787                                 PrintAndLog("Cant get block: %d", i);
1788                                 break;
1789                         }
1790                         for (j = 0; j < 16; j++)
1791                                 fprintf(f, "%02x", buf[j]);
1792                         fprintf(f,"\n");
1793                 }
1794                 fclose(f);
1795
1796                 PrintAndLog("Saved to file: %s", filename);
1797
1798                 return 0;
1799         }
1800 }
1801
1802 int CmdHF14AMfSniff(const char *Cmd){
1803         // params
1804         bool wantLogToFile = 0;
1805         bool wantDecrypt = 0;
1806         //bool wantSaveToEml = 0; TODO
1807         bool wantSaveToEmlFile = 0;
1808
1809         //var
1810         int res = 0;
1811         int len = 0;
1812         int blockLen = 0;
1813         int num = 0;
1814         int pckNum = 0;
1815         uint8_t uid[8];
1816         uint8_t atqa[2];
1817         uint8_t sak;
1818         bool isTag;
1819         uint32_t parity;
1820         uint8_t buf[3000];
1821         uint8_t * bufPtr = buf;
1822         memset(buf, 0x00, 3000);
1823
1824         if (param_getchar(Cmd, 0) == 'h') {
1825                 PrintAndLog("It continuously get data from the field and saves it to: log, emulator, emulator file.");
1826                 PrintAndLog("You can specify:");
1827                 PrintAndLog("    l - save encrypted sequence to logfile `uid.log`");
1828                 PrintAndLog("    d - decrypt sequence and put it to log file `uid.log`");
1829                 PrintAndLog(" n/a   e - decrypt sequence, collect read and write commands and save the result of the sequence to emulator memory");
1830                 PrintAndLog("    r - decrypt sequence, collect read and write commands and save the result of the sequence to emulator dump file `uid.eml`");
1831                 PrintAndLog("Usage:  hf mf sniff [l][d][e][r]");
1832                 PrintAndLog("  sample: hf mf sniff l d e");
1833                 return 0;
1834         }
1835
1836         for (int i = 0; i < 4; i++) {
1837                 char ctmp = param_getchar(Cmd, i);
1838                 if (ctmp == 'l' || ctmp == 'L') wantLogToFile = true;
1839                 if (ctmp == 'd' || ctmp == 'D') wantDecrypt = true;
1840                 //if (ctmp == 'e' || ctmp == 'E') wantSaveToEml = true; TODO
1841                 if (ctmp == 'f' || ctmp == 'F') wantSaveToEmlFile = true;
1842         }
1843
1844         printf("-------------------------------------------------------------------------\n");
1845         printf("Executing command. \n");
1846         printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");
1847         printf("Press the key on pc keyboard to abort the client.\n");
1848         printf("-------------------------------------------------------------------------\n");
1849
1850         UsbCommand c = {CMD_MIFARE_SNIFFER, {0, 0, 0}};
1851         clearCommandBuffer();
1852         SendCommand(&c);
1853
1854         // wait cycle
1855         while (true) {
1856                 printf(".");
1857                 fflush(stdout);
1858                 if (ukbhit()) {
1859                         getchar();
1860                         printf("\naborted via keyboard!\n");
1861                         break;
1862                 }
1863
1864     UsbCommand resp;
1865     if (WaitForResponseTimeout(CMD_ACK,&resp,2000)) {
1866                         res = resp.arg[0] & 0xff;
1867                         len = resp.arg[1];
1868                         num = resp.arg[2];
1869
1870                         if (res == 0) return 0;
1871                         if (res == 1) {
1872                                 if (num ==0) {
1873                                         bufPtr = buf;
1874                                         memset(buf, 0x00, 3000);
1875                                 }
1876                                 memcpy(bufPtr, resp.d.asBytes, len);
1877                                 bufPtr += len;
1878                                 pckNum++;
1879                         }
1880                         if (res == 2) {
1881                                 blockLen = bufPtr - buf;
1882                                 bufPtr = buf;
1883                                 printf(">\n");
1884                                 PrintAndLog("received trace len: %d packages: %d", blockLen, pckNum);
1885                                 num = 0;
1886                                 while (bufPtr - buf + 9 < blockLen) {
1887                                         isTag = bufPtr[3] & 0x80 ? true:false;
1888                                         bufPtr += 4;
1889                                         parity = *((uint32_t *)(bufPtr));
1890                                         bufPtr += 4;
1891                                         len = bufPtr[0];
1892                                         bufPtr++;
1893                                         if ((len == 14) && (bufPtr[0] = 0xff) && (bufPtr[1] = 0xff)) {
1894                                                 memcpy(uid, bufPtr + 2, 7);
1895                                                 memcpy(atqa, bufPtr + 2 + 7, 2);
1896                                                 sak = bufPtr[11];
1897
1898                                                 PrintAndLog("tag select uid:%s atqa:%02x %02x sak:0x%02x", sprint_hex(uid, 7), atqa[0], atqa[1], sak);
1899                                                 if (wantLogToFile || wantDecrypt) {
1900                                                         FillFileNameByUID(logHexFileName, uid, ".log", 7);
1901                                                         AddLogCurrentDT(logHexFileName);
1902                                                 }
1903                                                 if (wantDecrypt) mfTraceInit(uid, atqa, sak, wantSaveToEmlFile);
1904                                         } else {
1905                                                 PrintAndLog("%s(%d):%s", isTag ? "TAG":"RDR", num, sprint_hex(bufPtr, len));
1906                                                 if (wantLogToFile) AddLogHex(logHexFileName, isTag ? "TAG: ":"RDR: ", bufPtr, len);
1907                                                 if (wantDecrypt) mfTraceDecode(bufPtr, len, parity, wantSaveToEmlFile);
1908                                         }
1909                                         bufPtr += len;
1910                                         num++;
1911                                 }
1912                         }
1913                 } // resp not NILL
1914         } // while (true)
1915
1916         return 0;
1917 }
1918
1919 static command_t CommandTable[] =
1920 {
1921   {"help",              CmdHelp,                                                1, "This help"},
1922   {"dbg",                       CmdHF14AMfDbg,                  0, "Set default debug mode"},
1923   {"rdbl",              CmdHF14AMfRdBl,                 0, "Read MIFARE classic block"},
1924   {"urdbl",              CmdHF14AMfURdBl,                 0, "Read MIFARE Ultralight block"},
1925   {"urdcard",           CmdHF14AMfURdCard,               0,"Read MIFARE Ultralight Card"},
1926   {"uwrbl",             CmdHF14AMfUWrBl,                0,"Write MIFARE Ultralight block"},
1927   {"rdsc",              CmdHF14AMfRdSc,                 0, "Read MIFARE classic sector"},
1928   {"dump",              CmdHF14AMfDump,                 0, "Dump MIFARE classic tag to binary file"},
1929   {"restore",   CmdHF14AMfRestore,      0, "Restore MIFARE classic binary file to BLANK tag"},
1930   {"wrbl",              CmdHF14AMfWrBl,                 0, "Write MIFARE classic block"},
1931   {"chk",                       CmdHF14AMfChk,                  0, "Test block keys"},
1932   {"mifare",    CmdHF14AMifare,                 0, "Read parity error messages."},
1933   {"nested",    CmdHF14AMfNested,               0, "Test nested authentication"},
1934   {"sniff",             CmdHF14AMfSniff,                0, "Sniff card-reader communication"},
1935   {"sim",                       CmdHF14AMf1kSim,                0, "Simulate MIFARE card"},
1936   {"eclr",              CmdHF14AMfEClear,               0, "Clear simulator memory block"},
1937   {"eget",              CmdHF14AMfEGet,                 0, "Get simulator memory block"},
1938   {"eset",              CmdHF14AMfESet,                 0, "Set simulator memory block"},
1939   {"eload",             CmdHF14AMfELoad,                0, "Load from file emul dump"},
1940   {"esave",             CmdHF14AMfESave,                0, "Save to file emul dump"},
1941   {"ecfill",    CmdHF14AMfECFill,               0, "Fill simulator memory with help of keys from simulator"},
1942   {"ekeyprn",   CmdHF14AMfEKeyPrn,      0, "Print keys from simulator memory"},
1943   {"csetuid",   CmdHF14AMfCSetUID,      0, "Set UID for magic Chinese card"},
1944   {"csetblk",   CmdHF14AMfCSetBlk,      0, "Write block into magic Chinese card"},
1945   {"cgetblk",   CmdHF14AMfCGetBlk,      0, "Read block from magic Chinese card"},
1946   {"cgetsc",    CmdHF14AMfCGetSc,               0, "Read sector from magic Chinese card"},
1947   {"cload",             CmdHF14AMfCLoad,                0, "Load dump into magic Chinese card"},
1948   {"csave",             CmdHF14AMfCSave,                0, "Save dump from magic Chinese card into file or emulator"},
1949   {NULL, NULL, 0, NULL}
1950 };
1951
1952 int CmdHFMF(const char *Cmd)
1953 {
1954         // flush
1955         WaitForResponseTimeout(CMD_ACK,NULL,100);
1956
1957   CmdsParse(CommandTable, Cmd);
1958   return 0;
1959 }
1960
1961 int CmdHelp(const char *Cmd)
1962 {
1963   CmdsHelp(CommandTable);
1964   return 0;
1965 }